Privacy Policy
Last updated 31 July 2026
1. Who we are
Crenelle (“Crenelle”, “we”, “us”) is a QR-based access control and guest management platform operating from Lagos State, Nigeria.
For any question about this policy, or to exercise your rights, contact us at support@crenelle.org. Data protection enquiries are handled by the Crenelle team at that address.
2. The two roles we play — please read this first
Crenelle serves event organisers, who in turn invite guests. We therefore handle personal data in two capacities, and your rights differ depending on which applies to you.
If you are an event organiser (you hold a Crenelle account), we are the data controller for your account data, and this policy governs that relationship directly.
If you are a guest or attendee — you were invited to, or registered for, an event run on Crenelle — then the event organiser is the data controller and Crenelle acts as a data processor on their instructions. To have your data corrected or removed, contact the organiser who invited you. You may also contact us and we will assist them.
3. What we collect
If you are an event organiser
- Email address and password. Passwords are hashed by our authentication provider; we never see or store them in readable form.
- Your name or display name.
- Organisation name, timezone, currency, and date and time preferences.
- Sender profile details — the display name and reply-to address used on emails sent to your guests.
- Bank account name, account number, bank code and payment sub-account code, so ticket revenue can be settled to you.
- If you sign in with Google: your email address and basic profile only. We do not access any other Google data.
If you are a guest or attendee
- Your name.
- Your email address, to send your entry pass and any reminders.
- Your phone number, where provided, to send your pass by WhatsApp and to locate your booking at the entrance.
- Party size, and seat or table assignment where applicable.
- Ticket type and any associated benefits.
- A unique entry credential (a QR token). This is a random value and contains no personal information.
- Your registration status — pending, accepted, rejected or waitlisted.
Attendance and entry records
When your pass is scanned at an entrance we record that the entry occurred and when, which checkpoint scanned it, and whether entry was by camera scan or by manual name search at the gate.
This is a record of your presence at an event. It exists so organisers can manage capacity, prevent duplicate entry, and keep an audit trail.
We do not collect your device location, and we do not track you between events or outside the moment of entry.
Payment data
Where an event charges for tickets, payment is processed by Paystack.
Card numbers, CVV codes, PINs and bank credentials are entered on Paystack’s own secure checkout and never reach Crenelle’s servers. We do not store, transmit or have access to them.
We do store: your name, email address, the amount, currency, payment status, payment method type, Paystack’s transaction reference, and the time of payment. We also retain the confirmation Paystack sends us, which may include your phone number.
Technical data
- IP address, used to rate-limit registrations and gate scans to prevent abuse.
- Error and diagnostic data when something fails. For payment problems this can include the name, email address and transaction record involved.
- Strictly necessary cookies, to keep you signed in. We use no advertising cookies and we do not sell or share data for advertising.
What we do not do
We do not sell your personal data, use guest data for our own marketing, use it to train machine learning models, or make automated decisions with legal effects about you.
4. Our lawful bases
Under the Nigeria Data Protection Act 2023, and the UK/EU GDPR where it applies:
| Purpose | Lawful basis |
|---|---|
| Operating an organiser account | Performance of a contract |
| Issuing a pass and admitting you to an event | Performance of a contract, or the organiser's legitimate interest in controlling access |
| Processing ticket payment | Performance of a contract |
| Transactional email — your pass, reminders, changes | Performance of a contract, or legitimate interest |
| Retaining payment and entry records | Legal obligation for financial records, and legitimate interest in fraud prevention |
| Rate limiting and abuse prevention | Legitimate interest in service security |
| Error monitoring | Legitimate interest in service reliability |
5. Third parties who process data for us
| Provider | What it receives |
|---|---|
| Supabase — database, authentication, file storage | Account, guest, event, entry and payment records; uploaded banner images |
| Vercel — hosting | Request data including IP addresses, and server logs |
| Paystack — payments | Payer name, email and amount. Card data goes to Paystack directly, not through us |
| Resend — transactional email | Recipient name, email address, and email content including your pass |
| Meta Platforms (WhatsApp Cloud API) — pass delivery, where enabled | Recipient phone number, name and message content |
| Sentry — error monitoring | Diagnostic data. For payment errors this can include payer name, email and the transaction record |
| Upstash — rate limiting | Email addresses and IP addresses, held briefly as counters |
| Google — sign-in with Google, where used | Authentication exchange only |
We may also disclose data to professional advisers, or to a regulator, court or law enforcement body where legally required. If we are ever acquired or merge, personal data may transfer to the acquiring entity, and we will notify organisers before that happens.
6. International transfers
Our database, authentication and file storage are hosted by Supabase in the European Union (region eu-west-1, Ireland). Other providers above store or process data outside Nigeria, including in the United States and the European Union.
Where personal data leaves Nigeria we rely on the mechanisms permitted by sections 41 to 43 of the Nigeria Data Protection Act 2023: that the recipient is subject to a legal framework affording adequate protection, or is contractually bound to appropriate safeguards including standard contractual clauses. Where the UK/EU GDPR applies we rely on Standard Contractual Clauses or an applicable adequacy decision. You may request details of the safeguards applying to a specific transfer.
7. How long we keep data
| Data | Retention |
|---|---|
| Organiser account and settings | While your account is open, then 90 days after closure unless we must keep it longer |
| Guest name, contact details and pass | While the organiser's account and event remain active, or until the organiser removes it |
| Entry and attendance records | 24 months, as the organiser's audit trail |
| Payment records and confirmations | 6 years, to meet financial record-keeping and tax obligations and to resolve chargebacks |
| Email suppression list — unsubscribed or bounced addresses | Indefinitely. We must keep these to honour your request not to be emailed; deleting the record would cause us to email you again |
| Error and diagnostic logs | 30 days |
| Rate-limiting counters | Minutes to hours, automatically expired |
8. Your rights
Subject to the conditions in the Nigeria Data Protection Act 2023, and the GDPR where applicable, you have the right to be informed, to access your data, to have inaccurate data corrected, to erasure where we have no overriding obligation to keep it, to restrict processing, to object to processing based on legitimate interests, to data portability, to withdraw consent where we relied on it, and not to be subject to solely automated decisions.
To exercise any of these, email support@crenelle.org. We will respond within 30 days and may need to verify your identity first.
How erasure works in practice
Payment and entry records must be retained for the periods in section 7 for tax, audit and dispute purposes. Where we cannot delete a record outright, we remove or overwrite the personal details within it so you are no longer identifiable from it. Erasure requests are currently handled manually, within the 30-day window.
Guests
See section 2 — the event organiser is the controller of your data, so contact them first where possible.
Stopping emails
Use the unsubscribe link in the footer of any email we send. It takes effect immediately for all future sends.
Complaints
You may complain to us at the address above, and you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). Where the GDPR applies you may complain to your local supervisory authority.
9. Security
- All traffic is encrypted in transit using TLS, with HTTP Strict Transport Security enforced.
- Data is access-controlled at the database level, so one organiser cannot read another organiser’s guests, events or revenue.
- Entry credentials are long random values that cannot feasibly be guessed, and a pass can only be redeemed once.
- Payment card data never touches our systems.
- Payment notifications from Paystack are cryptographically verified before we act on them.
- Access to production systems is limited to Crenelle’s founders.
No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the NDPC within 72 hours and inform those affected without undue delay, as the Act requires.
10. Children
Crenelle is not directed at children and we do not knowingly collect data from anyone under 18. Organisers running events involving children are responsible for obtaining any consent the law requires. If you believe a child’s data has been provided to us, contact us and we will remove it.
11. Changes to this policy
We may update this policy. Where changes are material we will notify organisers by email and update the date at the top of this page. Continued use after the effective date constitutes acceptance.
12. Contact
Crenelle
Lagos State, Nigeria
support@crenelle.org